Crate rushdb_authz 

Graph-aware data access policies layered above the hard tenant boundary (plan document 23). Policies are compiled once into a SecurityScope with a stable fingerprint; enforcement is default-deny, evaluated by callers over MatchScope candidates and mutation images, and can only narrow the domain — never widen it.

Structs

ActiveAuthorizer

Engine authorizer reading live committed policy state (default-deny in PolicyEnforced mode). Implemented against the replicated keyspace.

ActivePolicy

A policy together with the commit that published it.

DataAccessPolicy

Tenant-scoped data-access restrictions applied to query results.

SecurityScope

Compiled security scope bound to one policy generation.

Enums

AuthorizationMode

How strongly a tenant’s data-access policy is enforced.

AuthzError

Errors produced while compiling or enforcing data access policies.

Functions

authorize_mutation

Mutation-side check over the new image (old-image revalidation happens at commit inside the engine’s own preconditions).

authorize_traversal_type

Rejects traversal through a relationship type the policy denies.

current_generation

Returns the committed policy generation for lmpg’s tenant, or 0 when no policy is active.

find_records_authorized

Authorized query execution (Records perspective): scans, masks output, enforces result caps. Tenant scoping underneath is structural.

load_active_policy

Loads the active policy for lmpg’s tenant from live committed state.

load_active_policy_in_view

Read one complete policy generation from one retained native view.

load_policy_from_reader

Policy loader over an injected key-reader. Used by the coordinator’s commit-time revalidation so it never opens a nested store view (which would deadlock under the store’s publish lock).

store_policy

Explicit administrative policy replacement. New tenant metadata overrides legacy global metadata for this tenant only; no legacy bytes are changed. The applying CI is assigned under admission, not before entering it.

store_policy_with_min_count

store_policy with a small-count threshold for catalog reads: groups counted over fewer than min_count records are withheld. 0 is no threshold and publishes exactly what store_policy does.

Type Aliases

QueryDirection

Exposes Direction / CollectSpec passthrough to keep engine facade tidy.